Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise founder Andrew describes a system that passively collects internet-wide scan and attack traffic from good, bad and unknown actors, then analyzes and enriches that data and compares it to what a customer sees on their own network. The company...
GreyNoise's Splunk app installs from Splunkbase and, once an API key is entered, scans configured indexes for IP addresses and matches them against GreyNoise's noise and RIOT datasets. In the demo, Nick Roy's main index holds 9,300 IP addresses, 92% of...
GreyNoise's Brad Chiappetta walks through the company's API documentation at docs.greynoise.io, covering the free Community API for basic IP lookups and the paid Enterprise APIs that return richer context on whether an IP is an internet scanner. He details...
GreyNoise released a Cortex XSOAR integration pack that enriches XSOAR alerts with GreyNoise data to filter false positives, identify compromised devices, and track emerging threats. The pack installs from the XSOAR marketplace with an API key, adds...
GreyNoise says it has catalogued over 10,000 cybersecurity products, each backed by a company with a marketing team, a Twitter account, a blog, and content aimed at enterprise security buyers. The episode covers founder Andrew's path to market, the latest...
Andrew Morris, founder of GreyNoise, describes starting the company from a 2013 pet project in which he set up honeypots on roughly ten $10 lifetime VPS instances across ten data centers and found the same IP addresses attacking all of them. He presented...
Red Canary researchers, in research written by Aedan Russell, documented ChromeLoader, a persistent browser hijacker that modifies browser settings and redirects users to advertising websites, with a Windows version that uses PowerShell and a Mac version...
GreyNoise published a "How I Use GreyNoise" video session featuring Cody Bernardy, Supriya Mazumdar, and Jordyn Childress. In the session, Bernardy discusses alert fatigue and CVE fatigue and describes how GreyNoise helps prioritize CVEs. What's...
A GreyNoise blog post describes a European CERT using GreyNoise to shorten what it calls "time to 'no'" in alert triage. The post frames the energy and utility sector as a prime target for threat actors because it maintains electricity, heat, and water...
GreyNoise published a 2023 guide to threat hunting, framed around the claim that cyber threats are growing more prevalent and sophisticated. The post describes threat hunting as an essential part of an organization's overall cybersecurity strategy and...
Robert, manager of Cybersecurity Incident Response & Operations at a large hospitality and food service company, leads a team of 4 analysts handling Tier 2+ alerts that were slow to investigate because every IDS/IPS alert was run. The team first used...
Hurricane Labs, a managed services team running Splunk ES and Phantom deployments for customers, saw alert volumes grow and overwhelm its analysts as it added more detections and new customers. Its Director of Managed Services turned to GreyNoise,...
GreyNoise Labs analyzed 30 days of October 2023 sensor data and observed 52,602 malicious exploitation attempts against Saudi Arabia's IP address space and 2,204 attacks originating from Saudi-assigned networks. Mirai and SSH bruteforcing led the inbound...
On July 1, 2024, Qualys disclosed CVE-2024-6387, a high-severity OpenSSH server flaw (CVSS 8.1) affecting versions 8.5p1 through 9.7p1 that could let unauthenticated remote attackers execute code with root privileges, with Palo Alto Networks' Xpanse...
A CISA Red Team assessment of a Federal Civilian Executive Branch organization found weaknesses in patch management, credential security, and network segmentation, pointing to the need for layered controls and behavior-based threat detection. The episode...
This episode of Storm⚡️Watch covers the CrowdStrike software update mishap that caused widespread outages for Windows devices globally and affected millions of users, along with a Microsoft Azure outage in the Central US region that stemmed from an...
DigiCert is revoking certificates with less than 24 hours' notice due to a validation issue affecting about 0.4% of its domain validations, potentially impacting thousands of SSL certs and causing outages worldwide starting July 30 at 19:30 UTC....
Check Point published an advisory on May 28, 2024 for CVE-2024-24919, a CVSS 8.6 path traversal flaw in Security Gateway that runs as root and lets an attacker read any file on the filesystem, with in-the-wild attacks dating to April 7, 2024. GreyNoise saw...
This GreyNoise podcast episode covers a Censys research report on internet-connected industrial control systems and their vulnerabilities, and examines the threat actor StormBamboo, which compromised an internet service provider to conduct DNS poisoning...
This GreyNoise Storm⚡️Watch episode covers the "0.0.0.0 Day" vulnerability, which lets malicious websites bypass browser security mechanisms in Chrome, Firefox, and Safari and potentially reach local services. It also covers a 2017 vulnerability still...
The Change Healthcare cyberattack, discovered February 21, 2024 and attributed to the ALPHV/BlackCat ransomware group, began when attackers used stolen credentials on a Citrix remote access portal without multi-factor authentication on February 12 and went...
The US government issued an advisory on the RansomHub ransomware group, which is believed to be responsible for a cyberattack on oil giant Halliburton and to have targeted at least 210 victims across critical infrastructure sectors since February 2024. The...
Columbus, Ohio initially claimed no data was stolen in its ransomware attack, then revealed that the Rhysida ransomware group had leaked 3.1 terabytes of sensitive data. A TDECU MOVEit incident, in which a third-party data-transfer vendor was compromised...
The U.S. Department of Justice filed a legal action against Georgia Tech and its research corporation over alleged cybersecurity violations. The episode also covers a credential leak in a SolarWinds Web Help Desk hotfix, an authentication flaw in...
This episode of GreyNoise's Storm⚡️Watch podcast covers the Columbus, Ohio cyberattack and its legal battles and data leaks, plus a Cyberside Chat on BLUUID, which extracts BTLE UUIDs from Android APK files to identify devices. The episode also discusses...
GreyNoise's honeypots have been monitoring exploit attempts against the SolarWinds Serv-U vulnerability, CVE-2024-28995, and recorded which files attackers are seeking. The data shows attackers targeting key system files and credential-containing...
A Censys study cited in this episode found more than 3,800 DICOM servers publicly exposed on the internet, putting data from 59 million patients at risk. The episode also covers Chinese hackers compromising the wiretap systems of major U.S. telecom and...
This episode of Storm⚡️Watch covers an attack on American Water that raised concerns about critical infrastructure and national security, and a series of DDoS attacks on the Internet Archive alongside a data breach affecting 31 million users. It also...
Transport for London is facing a cybersecurity "trainwreck," with an investigation revealing outdated systems and neglected security protocols that have exposed its infrastructure to significant risk. Separately, the White House has endorsed a more...
GreyNoise described its AI projects, including Sift, a tool that runs daily to process data from its global sensor fleet and identify novel behavior, traffic, and attacks, and said the same techniques can be applied to sensor subsets to produce...